Currently translated at 17.7% (11 of 62 strings)

Translation: Tails/wiki/src/news/version_3.14.1.*.po
Translate-URL: http://translate.tails.boum.org/projects/tails/wikisrcnewsversion_3141po/pt/

Currently translated at 39.0% (16 of 41 strings)

Translation: Tails/wiki/src/news/version_3.11.*.po
Translate-URL: http://translate.tails.boum.org/projects/tails/wikisrcnewsversion_311po/it/

apparmor 2.13.2-10 updated abstractions/base in a way that conflicts
with the tweaks we do there to support AppArmor aliases.

I've uploaded Stretch's live-boot to our feature-buster APT overlay suite.
Let's install it and postpone finishing these adjustments. Accordingly, let's
revert our code to a state suitable for Stretch's live-boot.

This reverts commits 016e53e9,
4377f177,
99a01f8a,
df3c2dea,
928c868e
and 8b452697.

Thunderbird 60 needs access there and who knows what might break
in surprising, hard to debug ways, if we block it.

Backport from upstream commit 6d22c871bfb17da7620efab4ad5c41960d1efd41,
first released in Debian via apparmor 2.13-1.

The /lib/** kind of rules don't conflict anymore with the ones generated
due to the AppArmor aliases we set up to support /run/live/*.

This will avoid maintaining these settings as a patch.

Refs: #8415

This avoids having to maintain this as part of e.g. the Totem profile.
I expect more profiles will need it at some point anyway.

It is quite a bit more picky and failed to load profiles with:

  profile has merged rule with conflicting x modifiers
  ERROR processing regexs for profile sanitized_helper, failed to load

Looking at it closely, one realizes that it's totally correct, and our previous
adjustments were incomplete.

This change includes re-diff'ing so that this patch applies cleanly against
the profiles shipped by apparmor 2.9.0-3~bpo70+1 (uploaded to our APT overlay
for this branch, but not to Debian yet).

Make the AppArmor alias for /lib/live/mount/rootfs/filesystem.squashfs/ more generic, so that it covers SquashFS installed by automatic upgrades as well.

Use aliases so that our AppArmor policy applies to /lib/live/mount/overlay/ and /lib/live/mount/rootfs/filesystem.squashfs/ as well as to it applies to /.

That's something I wanted to avoid initially, for various reasons that are
explained already in [[contribute/design/application_isolation]]. However, now
that /lib/live/mount/overlay/ is accessible, I see no better way to protect
files accessed via this path as well as the same files accessed by
"normal" paths.

These changes are likely to increase policy compilation time a bit, benchmarking
will tell. If that's too severe a problem, we have a few potential ways out,
that are already documented in the "Increased policy compilation time" section
of the aforementioned piece of design doc.